Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
25-05-2024 06:23
General
-
Target
2024-05-25_0fed54f0a437bce1dfca7e069699c383_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
0fed54f0a437bce1dfca7e069699c383
-
SHA1
e8d1102ce2f84a2b960c2a0744206223501cdaf7
-
SHA256
bbcfdb3009ea90aca6b1e9d7d857b8586cdf5eaae9ffb875d9cf43cb30b10179
-
SHA512
5012aae5420aa8148c5800c935b7811f268f8f6c9bc07e32ee18dab7364eeee601ef06f06e695988fd856b068c2fe3ad8a71f1946c329a9f632047e07c360ee0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUT
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_0fed54f0a437bce1dfca7e069699c383_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_0fed54f0a437bce1dfca7e069699c383_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UciGZTC.exeC:\Windows\System\UciGZTC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\DmyTiEy.exeC:\Windows\System\DmyTiEy.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\FTaexbL.exeC:\Windows\System\FTaexbL.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\raEMhML.exeC:\Windows\System\raEMhML.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\kzPGKZV.exeC:\Windows\System\kzPGKZV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\kGFyiDP.exeC:\Windows\System\kGFyiDP.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\dVvAiHW.exeC:\Windows\System\dVvAiHW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\pcBZtCO.exeC:\Windows\System\pcBZtCO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\orTDJSX.exeC:\Windows\System\orTDJSX.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\bjjNVVc.exeC:\Windows\System\bjjNVVc.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\isLRlgm.exeC:\Windows\System\isLRlgm.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\nXfYaSs.exeC:\Windows\System\nXfYaSs.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xUzWTIq.exeC:\Windows\System\xUzWTIq.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\MvxwsrQ.exeC:\Windows\System\MvxwsrQ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\IPXRGCg.exeC:\Windows\System\IPXRGCg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\HFnxLjb.exeC:\Windows\System\HFnxLjb.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\MRFeMyt.exeC:\Windows\System\MRFeMyt.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GnCklYQ.exeC:\Windows\System\GnCklYQ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ptzoETj.exeC:\Windows\System\ptzoETj.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qThnJVl.exeC:\Windows\System\qThnJVl.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\topJOnD.exeC:\Windows\System\topJOnD.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD542cf38be6188e76a63f63d0707b29a76
SHA1db49b2e3f30ccea63d211c040a8002a17115f013
SHA2567ffaf0a9f4aefc4a405804540dbbedd37d771e471f9c7ec5761965523e783bae
SHA512691359e48062ef1cf3b61992f0e1ad67c35337b3ebc94fca6404654d7f33ca97debd00b237fd5481664e4035b58d68364a8b00a20fb4a482b1dd92400fab3140
-
Filesize
5.2MB
MD5f85ceffabba0a88c2a4fab5df91ca8fe
SHA1406dda82605405cf76a84bb42284bd80b7acbb8a
SHA256d796aaf09c7340cec088eed97dc09ea552a341bda4ec9377ba7a887ef13c29c6
SHA512ed0b1e978dc81b892e80460c87bc2e62d36be6150d369695c8387d2270f64f1f1fe3f3e5f07b2473fb0fd8a99a1cbdca720a729d41a27f0c69223a3305776d5f
-
Filesize
5.2MB
MD5294ad3a0a6d4a43c308c37ba3aac78b3
SHA11b5c63ddcc72a7597d838271846466521ebe10a7
SHA25662ee91036d6ea80b06e01bd71b25399d20e8bd4db38a815f12fa067625c60a84
SHA5129ed69510543eda8db6305fadfd4126ea7d2edd39d171139b75fca2e816021c85078b3fa64ae737630df28d0b95b2614ae6cddef22a5297a5f27380e4b8610fe9
-
Filesize
5.2MB
MD52537e5f28283006838fe53754be51a4a
SHA14cc0bbfa22a65cfbf518d022cd1177e214844de5
SHA25683df1d9897d46fdc36a0305b575589cd0981940cd4a5100653002a268285b477
SHA512757f5dbec57beca5300d49ddccf3f5dfeae15cc9ac0bd188de1af94280c14cb6ed4a5196f85dc2aa4679fd5c3c758b65e314e541143e30461664c47d2b5ee858
-
Filesize
5.1MB
MD55ea295cc31a0847144d008de08de86c5
SHA1b6026a96de8d9add832452ca646612a2365a0909
SHA256339cdfd36c5a4e82196d83dfcc2faf8077b2d11f39503810c05ed5db649a945f
SHA512d59e8f5447c9505365d8c3fb9be948cb7467dc423db179a05ad04b3e353b46b5b7f198730865b68d88101aa49cf9a110099831a11e0e26b491c8635b1303c380
-
Filesize
5.2MB
MD528abd77bd20cf9c6801d53dc9879a53c
SHA18b6ce0a8783aafa47a8c130093a3f53a2b15ac63
SHA2563a68af3e0de9a029cb940f2c417565a91ae4d7a93ec04f17dd89724508f9faaa
SHA51215e08857117563a89fcf64fd56a55f37058ee9f0ab03ea60b7ccce20559c5940451b91244429dcf28594c081fdc6fbba462d69ed4ee86821573f3a5887253a71
-
Filesize
5.2MB
MD5c7c1c487bcce397fa9f81ba52e2ee09f
SHA1b3460aa720100ae0e3fa7101e8a0b48df956fcda
SHA256a4e8d5066b3600858116a0d1e66389e40490ad13a32978ad1542d513d52d6839
SHA512ed92ae5302261de38fa50c5be57ab56a771848e1ff78b3ec854a84f983643674d1256800c872bc1f8b942232486ded8f794b39eca4012568653ae6cc65d3d106
-
Filesize
5.2MB
MD5eaa4f4f5172ef9b0ac335d488db3a98d
SHA175aa2346d0ba93b2480533b2e2bc039636fb7dbb
SHA2560d3c5a619535743a64b4dd6d91e2f72dc1fa9fd8f1a960ea75385b60f48a55b7
SHA512c1639132019ea12ee203b3a33496a7b506c9a45cc30923370b141baee62f062417b64e85e90e6e89347064b62b7a2b4d9fb115b3a1f3f1d8463e6faff75d3d66
-
Filesize
5.2MB
MD59dc1b533aa69abbeeebafbcd3ce9e949
SHA151139e4f4623c47a8788b93eb25dd127eca2ef4b
SHA2562a2404e99872d427cbdfb6401ee40397b55874c37ece6189113727f443118371
SHA5121fcd357f2b48b298638e027dd192c3cb20ad100cbce0e64a60bb2771716edc71365b6ae6276f6297fa74752791cdccc00211ee4e964206ed19d82e52c14202bf
-
Filesize
5.2MB
MD5c8fbd3dd4025de257e5c29cf33f8f610
SHA1757f1c3c19d2bcae86c2e82e506c48ba78fd70b4
SHA256ad8bcc4d8744343704eab02e612b5ba0e4e110cb9e118e9419667ded1f945c88
SHA512a7ab34a02f6dbe844eac723d923683b88e4ee25ff0bb5769fcf3ba091f209544637d34a4b810c4ffd7bde824642876b97a7f247a6e11434d7c8a2e61cc969663
-
Filesize
5.2MB
MD52e7be5ba6045f3c76c37f0d0adf47d5f
SHA1b378ad7ebd56e486e15ca6a44f787f95fe7fae3f
SHA2563c3bee8b0b3484b9edaea80f7d8406b4bed6a1fe436a6991941e70a7b448045d
SHA5129fe4032859c4254b46663ed0ac1bc717df7fa3e57dd5ce0e8245c5d043648e14bb58fc17fd73184056e44e545dbde7c7100603c044cb36dcc309b26c6a0beb6b
-
Filesize
5.2MB
MD5680906c8d1a6cfc704cd0a8b4983661e
SHA14bfd00f9fc406fdf7c9dd7d3092f3edce3d58230
SHA2562b37d21299aa811cb7ef43318bda7006017cbb549b2da4e46d8a23845b1d95f2
SHA5123f64d8e04b9c2a70c9d357f448e188279f42a44211736dae331bf1ce249dfb88f136913d419703a151628bda21795b73bc4f35a336c431bbeec074a319be638c
-
Filesize
5.2MB
MD5d176316532fb2089b09cf4195dfec958
SHA1c747ab0595d0fee3758f24e4ca25bed82fa0fcee
SHA25620f63c2c7c433e29cc582f64ca12e232569a410dcbf96113fee93eb9e194f87e
SHA51201a2a3a382f32ea8c06385abb17d7d9adff2459d065c5dfd53b5e3d4856b6e35836ba841e9f8c243f5093c29814b527547e02aba89bf0ac4f43370c82ca20881
-
Filesize
5.2MB
MD55bfa99c09e367969efda975f61335da7
SHA101746d6e38fdd6d884c2232dbe04ff2c89695296
SHA256378489f896ea2a6dc88479e805888271d6464f4e290009309a22b8f638e010c3
SHA512b56577bbd0b3dfc50b3ebc5996c3795f6f1bdf6f8ae0b5e39ed889623e84645d7f552a9e4bc623267a7921e6ce1d3ed9b38eb26f2d574376c4d84be76860916a
-
Filesize
5.2MB
MD5a11179c34b6a5daca0a553445fb5947c
SHA1a4485296ba9ea24a0745686cb2ecae53886d3d71
SHA256a59f1d8dcb88f6a1b4503e9deebc42ba10a1aa8d638816c504201115344577ca
SHA5128ce288dfdd9861bd287301f160be36917bff1cff96232a5b9a15428d76b132e90b095886fe38277158a137881c18337708f332ff990f7c7e558119f0d6eb3568
-
Filesize
5.2MB
MD5f8043f1aaca3fd6fb7a35c9a8fdf70fb
SHA18484998f0c926a4c71a9b2e20d2029c90cf48281
SHA25674c09dccff29b54375bc5752d8af1a9cc6cc9f920e0ed9e755056614cdcf2dbf
SHA51230bec5827eea188b46ea299da9a1ea9057522f87d5708b3704da80d90b563dfec3eeffe82fb55701dbb6e4f8ec96b3ec2a5b69f76a8993289c3a6c347c8d9a5e
-
Filesize
5.2MB
MD5d0f1283f092c703c4e071352c4e276de
SHA175aabcdee2170e4b86f44de7d50f01a704c8c92a
SHA256effa5527c8a55b515cdd70779a0f914fde48677851a77b12e3b9ce1e94a2a11a
SHA51239e35fa2802231cc3032acf61163e0292741fe5cc59957448c448967bd67634c17eafb640bf3b35aeb8d953c678f42cca2d666256c7116e2795b7a87ab8f9565
-
Filesize
5.2MB
MD51c092e64722a57a80f963926a3a72b4d
SHA1dc74a0f5c36c2070ee2a2ca71646cce1593ad7b2
SHA256d47df42919991c7b793124af1041a60d4012d1be3d5951324bf718f0dacb99d8
SHA512f05a8f9b5c0e035a6ba3300f59d0fbea5f2cfdc336054387d9d03aac2fcd73ac58efd54a148acaf4b6596903ab4d66e6cdc2c2b925e8dfe86414ad87750baea1
-
Filesize
5.2MB
MD50127360c00e336faadc7b004f4f7f505
SHA1ecc32c41d5a312b02044e07a340331bdf63dcd6d
SHA256d87925df3afb4f786a13738eb3851b3c9f4f424a6df2ab840922dc6fba431013
SHA512014ecab7833865f04fa844431cf92ec09565d64619aae6763993fbcd6975f26fcc64c98ca7955c7ca65d880608e97d91d2941084c25a7a60bfd76830e85d2da9
-
Filesize
5.2MB
MD59e3147abd8b7fe3f62ed3f48b5922f9a
SHA1688d5cc1d80e1700aa570848ee4f2ff151a2a326
SHA2560c9d0b0f17377a1f5a4240a23f81d43ba9811458983d075575464995583f36e9
SHA512b7324818799a40f3e49751fba9c65222a73d7ea148e772a797ab820598b9eae07902f01d1ec298ce8f08b8977379d484d4e1b78111e7976ddc94293aeb8e076c
-
Filesize
5.2MB
MD51cbe177ea4d231b8f01ef79105106be6
SHA198e5f58e275f4573c614b6d516b81a984fbf8279
SHA2564bb42cd9fc8d4eecd308603796e5aa4d2eb65eee2387ff22dee5059e982860d2
SHA5120fcea248040f7b1a67d7216ff316613ec09293cf731ee57a36124660a597c2ae8e82783354890010512537ffaf7351c6a8d42a806d6ac01388c21071ca44e0d9
-
Filesize
5.2MB
MD56862cc7574b2881dab3481090d15aef3
SHA12592db795504fbab95c57fa09011b03458d08802
SHA25662a34a0f3d42de060b53e9912be10947a5c37dbb78d4873e500612cfe4e1cb59
SHA5129981c1959c9eeeb22eb11189045699a2b83878e3db23cba6e42c148503390cda4efd047e235be2b84e144cb594427ac17cabdb0fed86e4ef01e006b9e181428c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB